Run security scan

<Info>This API is in beta. Endpoints, fields, and behavior may still change, so avoid depending on it in production.</Info>

Scans the app for security problems and returns the findings.

The response is the same shape as Get security scan, and which of two things you get depends on whether Base44 already has a current answer:

• If the last scan still matches the app, you get it straight back with status set to up_to_date, and the X-Scan-Source response header set to cache. Nothing is re-scanned.
• Otherwise a scan starts in the background and you get status set to scanning with the previous findings still in result, and X-Scan-Source set to async. Poll Get security scan while status is pending or scanning, since both mean a scan is still going to settle.

So a 200 here does not mean a scan ran, and it does not mean the findings in the body are current. Read status and the X-Scan-Source header to tell the two apart.

A real scan reads the app's code and runs a language model over it, which takes a while and is why it runs in the background rather than on your connection. This endpoint is limited to 5 requests per minute.

<Note>Findings are only ever as fresh as the scan that produced them. On out_of_date the app has changed since, so treat the findings as a previous snapshot and run a new scan before acting on them.</Note>

<Warning>The response includes fields beyond the ones documented here. Don't rely on undocumented response fields, as they can change at any time.</Warning>

{
  "status": "up_to_date",
  "result": {
    "analysis_summary": "The app exposes orders to any signed-in user and has one hardcoded credential.",
    "rls_recommendations": [],
    "hardcoded_secrets": [],
    "backend_functions": [],
    "dependency_vulnerabilities": [],
    "static_code_findings": [],
    "header_recommendations": [],
    "core_integration_recommendation": "compatible",
    "scanned_at": "2026-08-25T14:05:00Z"
  },
  "static_code_enabled": true
}